How to use ps

The ps command is very useful at getting a snapshot overview of what processes are currently running on a system. This information can be extremely useful for attempting to discover what is causing a server to behave sluggishly.

In order to maximize the information that is provided by this command there are two different ways that it is suggested it be used:

ps aux or ps auxf

The difference being that the f flag will group together like processes into a process tree.

Below is an example of the command ps aux being run on a server:

Click image to enlarge

Below is an example of the ps auxf command in action:

Click image to enlarge

The process tree seen above shows you what processes belong together, with the “parent” process being the one at the top of the list, and the “child” processes that were created by the parent process appearing below.

So what do we see in the process list?

USER – Tells us what user on the server owns/is running the process.

PID – The process ID on the server. Can be used to stop processes if needed via the commands kill or killall.

%CPU – Percentage of the CPU the process is using.

%MEM – Percentage of total RAM (memory) the process is using.

VSZ – Virtual memory size of the process. This may be stored in either the main memory (RAM), on the hard drive in swap space, or a combination of both.

RSS – Real memory (RAM) size of the process.

TTY – Indicates which terminal the process is running on. ? means they are running locally on the server, not by any remote terminal or local X terminal.